CapsAdmin PAC3 http.lua cross site scripting

Vulnerability

A cross-site scripting (XSS) vulnerability exists in CapsAdmin PAC3, specifically in the file lua/pac3/core/shared/http.lua. The function pac.FixUrl did not properly sanitize user-supplied input passed via the url argument. This allowed an attacker to inject malicious HTML or JavaScript code, leading to XSS. The issue was addressed in commit 8fc9e12 [2] and pull request #1210 [1]. The vulnerability affects all versions prior to the patch.

Exploitation

An attacker can remotely trigger the vulnerability by sending a crafted URL containing malicious characters such as ", ', <, >, or newline characters to the vulnerable endpoint. No authentication or special privileges are required, as the attack can be launched over the network. The exploitation involves manipulating the url argument in a request that reaches the http.lua file.

Impact

Successful exploitation allows an attacker to execute arbitrary HTML and JavaScript in the context of the victim's session. This could lead to session hijacking, defacement, or theft of sensitive information. The impact is limited to the PAC3 environment and the user's browser context.

Mitigation

The fix was implemented in commit 8fc9e12dfa21d757be6eb4194c763e848b299ac0 [2]. Users should update to the latest version of PAC3 that includes this patch. No workarounds have been publicly disclosed, and the patch is considered the recommended mitigation. The vulnerability is identified as VDB-217646.